# Ephemeral processing Emboss can process a form without keeping the document afterward. **Ephemeral processing** is a retention mode: once a form goes quiet, its documents are deleted, not just marked for later cleanup. ## The switch Every account has a retention default, set on the [account page](/dashboard/account): `ephemeral` or `account_default`. The create and with-context calls also take an optional `retention` body field with the same two values, so a single request can override the account's default for that one form. Leave it out and the account's own default applies. The two values are `ephemeral` and `account_default`; the field lives on `POST /forms`, `POST /forms/with-context`, `POST /forms/{form_id}/with-context`, `POST /forms/prepare`, `POST /forms/{form_id}/prepare`, and `POST /forms/{form_id}/fill-batch`. The [MCP tools](/docs/mcp-tools) and [A2A skills](/docs/a2a) of the same shape, `create_form`, `fill_form`, `fill_form_from_context`, `prepare_form` and `fill_batch` on MCP, and their A2A counterparts, take the same `retention` argument with the same two values. ## The pay-per-call API is always ephemeral The pay-per-call API has no account behind it, so every request to it always runs under ephemeral processing. There is nothing to opt out of and no field to set: an anonymous caller's documents are deleted on the same schedule as an account holder's `ephemeral` form. A price that is never paid expires an hour after the request, and the documents sent with it are deleted at the next cleanup, within ten minutes after that. Once a job is paid for, its status and result stay available for 24 hours from the price, so a lost answer can be fetched again; the job's files follow the window below. ## The window Ephemeral processing: source and output documents are deleted 60 to 70 minutes after the last activity on a form. A background sweep runs every ten minutes, so a form's documents are gone somewhere inside that window after the last activity on it, not on the stroke of the sentence's own number. Outputs of a free [PDF utility](/docs/pdf-utilities) follow the same window, measured from creation rather than last activity, for every caller. The `xfa_data` export a fill of an [XFA form](/docs/xfa-forms) returns follows the filled PDF's own retention: it is deleted on the same sweep, and answers `410` once the filled PDF does. The `xfa_render` page drawn from a dynamic XFA form's template follows the form's own retention, with its fillable copy and thumbnail. ## What the value check sends After a fill, Emboss asks a decision model (TypeSafe's Jev, reached through OpenRouter, listed on the [subprocessor page](/subprocessors)) whether each written value belongs in its box, and, when your documents offered two competing values for one box, which one belongs. For each box it sends the form's title, the box's name and kind, the words printed beside a box on the form, the value written, and the names and values of the boxes on the same row. For a competing pair it also sends, for each value, the name of the document and the page it came from, up to 200 characters on each side of the quote, and the names of the other boxes on that page. It sends no whole document, never the form image, and never anything that identifies your account. The answers are probabilities. A doubt appears as a note on the receipt; the value is written as filled. Retention at the providers is governed by their policies: [OpenRouter's privacy policy](https://openrouter.ai/privacy) and [TypeSafe's privacy policy](https://typesafe.ai/legal/privacy-policy). Turning the check off is an operator setting; the fill behaves as before when it is off. ## What a 410 means Once a form has been swept, its document routes, the flat upload, the fillable copy, the thumbnail and the filled output, answer `410 Gone`. The receipt is the exception: it keeps answering `200` with the values redacted out. The problem detail on the 410 response is the sentence itself: a swept form's document routes answer HTTP 410 with the retention sentence as the problem detail. A 410 is not an error to retry: it means the window closed and the documents are gone. ## What a redacted receipt still proves The receipt survives a sweep even though the documents behind it do not. What is deleted: the uploaded form, the fillable copy and the thumbnail, the supporting documents, every filled output and batch output, and the session's values, the proposal's evidence and the receipt's values themselves. What is kept: the blank form's layout, the execution receipt's record (ids, file sizes and fingerprints, timestamps, and the retention block that recorded which policy applied and when it was swept), a record of each file without the file itself, payment and usage records, and security logs. A redacted receipt proves what happened and when, and against which files, by their sizes and fingerprints, without holding onto a single label or value. ## Where to read more - [Security](/security) lists exactly what is kept and what is deleted, and how documents are handled in transit and at rest. - [Subprocessors](/subprocessors) describes the providers a request passes through while it runs. - [Read a filled form back](/docs/read-filled-form) on an account stores nothing at all, not even for the retention window: there is no document to sweep. The pay-per-call read holds the file only until it is paid for, and keeps the values it read with the job for 24 hours. ## See also - [Pre-fill forms from context documents](https://getemboss.ai/use-cases/prefill-from-context) - [Fillable PDF](https://getemboss.ai/glossary/fillable-pdf) - [Read a filled form back](https://getemboss.ai/docs/read-filled-form) - [Pay per call](https://getemboss.ai/docs/pay-per-call) - [Fill from context docs](https://getemboss.ai/docs/fill-from-context) - [Security](https://getemboss.ai/security) - [Subprocessors](https://getemboss.ai/subprocessors)